@@ -82,14 +82,16 @@ func QueryAlerts(limit int64, retry int) (models.Alerts, error) {
8282 for _ , d := range ds {
8383 if dm , ok := d .(map [string ]interface {}); ok {
8484 var dec models.Decision
85+ dec .ID = getInt (dm , "id" )
8586 dec .UUID = getString (dm , "uuid" )
8687 dec .Scenario = getString (dm , "scenario" )
8788 dec .IPAddress = getString (dm , "value" )
8889 dec .Type = getString (dm , "type" )
89- dec .Duration = calculateOriginalDuration (dec .CreatedAt , dec .Until )
9090 dec .Scope = getString (dm , "scope" )
91- dec .Until = getString (dm , "until" )
92- dec .CreatedAt = getString (dm , "created_at" )
91+
92+ // Calculate original duration because CrowdSec API provides duration as remainder?
93+ remainingDuration := getString (dm , "duration" )
94+ dec .Duration = calculateOriginalDuration (a .CreatedAt , remainingDuration )
9395
9496 dec .Country = a .Country
9597 dec .AsName = a .AsName
@@ -123,22 +125,36 @@ func getFloat(m map[string]interface{}, key string) float64 {
123125 return 0
124126}
125127
126- // calculateOriginalDuration calculates the original ban duration from created_at and until timestamps
127- func calculateOriginalDuration (createdAt , until string ) string {
128- if createdAt == "" || until == "" {
128+ func getInt (m map [string ]interface {}, key string ) int {
129+ if v , ok := m [key ].(float64 ); ok {
130+ return int (v )
131+ }
132+ if v , ok := m [key ].(int ); ok {
133+ return v
134+ }
135+ return 0
136+ }
137+
138+ func calculateOriginalDuration (alertCreatedAt , remainingDuration string ) string {
139+ if alertCreatedAt == "" || remainingDuration == "" {
129140 return ""
130141 }
131142
132- createdTime , err := time .Parse ( time . RFC3339 , createdAt )
143+ remaining , err := time .ParseDuration ( remainingDuration )
133144 if err != nil {
134145 return ""
135146 }
136147
137- untilTime , err := time .Parse (time .RFC3339 , until )
148+ alertTime , err := time .Parse (time .RFC3339 , alertCreatedAt )
138149 if err != nil {
139150 return ""
140151 }
141152
142- duration := untilTime .Sub (createdTime )
143- return duration .String ()
153+ now := time .Now ()
154+ elapsed := now .Sub (alertTime )
155+ originalDuration := remaining + elapsed
156+
157+ // Round to nearest minute to avoid duplicate metrics
158+ // Could be flaky, but better than nothing
159+ return originalDuration .Round (time .Minute ).String ()
144160}
0 commit comments